MALICIOUS
128
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a critical heuristic indicating it links to known malicious redirector infrastructure. It also exhibits a PDF link farm, suggesting an attempt to game search engines or distribute malicious links broadly. The document body, though heavily obfuscated, contains a URL that matches the malicious redirector found by the heuristic. The primary attack pattern involves luring the user to click a link that ultimately leads to malicious content.
Heuristics 4
-
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINKPDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ttraff.ru/pify?keyword=union+budget+2019-+20+pdf++upsc
- http://bozow.authorjhawki.com/uploads/1/3/1/6/131606289/pukuwexiro_kewetapatira_lukibi_lenulubefo.pdf
- https://cdn.shopify.com/s/files/1/0428/5651/3692/files/international_truck_parts_catalog.pdf
- https://cdn.shopify.com/s/files/1/0432/5441/5515/files/android_8_google_account_bypass.pdf
- https://cdn.shopify.com/s/files/1/0437/8053/8526/files/acsm_certification_review_4th_edition.pdf
- https://cdn.shopify.com/s/files/1/0431/7921/2959/files/zazezuf.pdf
- https://cdn.shopify.com/s/files/1/0438/9958/4664/files/83884588657.pdf
- https://cdn.shopify.com/s/files/1/0438/6720/9883/files/efectos_de_las_auxinas.pdf
- https://cdn.shopify.com/s/files/1/0430/8706/9348/files/99169618800.pdf
- https://cdn.shopify.com/s/files/1/0429/3846/6467/files/87498312980.pdf
- https://cdn.shopify.com/s/files/1/0430/2998/7489/files/bufavujoradivixufufesar.pdf
- https://cdn.shopify.com/s/files/1/0429/9754/7157/files/loxemuvulivif.pdf
- https://cdn.shopify.com/s/files/1/0436/2692/2146/files/art_adherence_guidelines.pdf
- https://cdn.shopify.com/s/files/1/0428/6542/6598/files/data_structures_and_algorithms_with_python_kent_d._lee.pdf
- https://cdn.shopify.com/s/files/1/0438/3493/3408/files/14551905601.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://cdn.shopify.com/s/files/1/0430/299
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000085c9.bin9158a6f95c008a95260e0cf0fb09758b7eecd67a70b371dac00e6ec3ee3394db |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x85C9 | 5632 bytes |
font_01_sfnt_off0000990f.bin6504d5e4c19dadcdaf26e137d25fe2861f5b085b0fdc243b08b3c0bc2dd32787 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x990F | 10832 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.